"Resource not accessible by integration"

[AstraLuma]

https://github.com/ppb/pursuedpybear/pull/359/checks?check_run_id=211188070

https://github.com/ppb/pursuedpybear/blob/master/.github/workflows/greetings.yml

[JJ]

This happens as soon as the person creating the PR does not have permission to the repository. I've been all day with this, and there does not seem to be a solution. Same problem as here actions/labeler#12.

[AstraLuma]

Eh? Actions run under their own credentials, not as a user??

[JJ]

Actions run as an user, but when they are running in a fork there are potential security problems, so they are degraded to "read-only"

[AstraLuma]

I'm confused. This is an action configured in the main repo for a PR in the main repo?

[AstraLuma]

Oh, PR events are sent to the fork under the source branch, not to to the target repo/branch?

[mangelajo]

Ok, github needs to fix this. I'm facing the same thing while trying to create an action.

[kaxil]

We faced similar issue when trying to use greeting for Airflow project (https://github.com/apache/airflow). So we developed a Github app which is working well for us in case someone faces similar issue:

https://github.com/kaxil/boring-cyborg

[joshgoebel]

Is this the same issue as with labeler? actions/labeler#50

If so, can the same solution also be applied (at least as a stopgap)? Very frustrating that Github seems to push these actions hard in their UI but then they don't work with the most common use case on GitHub for OSS projects.

[gunnsth]

Getting this too: https://github.com/unidoc/unipdf/pull/269/checks?check_run_id=486244746
Would make sense to skip the action if needed resources are not available? Or an option to make it required/optional. Some actions might be required, but a greeting hardly, but this is flagging a valid PR as failing due to this.

[joshgoebel]

Some actions might be required, but a greeting hardly, but this is flagging a valid PR as failing due to this.

Yes, very good point also. Not all actions are created equal (in that they should kill the whole workflow from moving forward).

[Borda]

the same issue also here - https://github.com/PyTorchLightning/pytorch-lightning/pull/1101/checks?check_run_id=496573752

[joshgoebel]

Anyone alive here: Is this the same issue as with labeler? actions/labeler#50

I added this to a project but I guess I'm about to rip it out - the use case seems extremely limited - not at all suited for large OSS projects with many contributors. And those are exactly the projects where this type of thing would be most helpful.

[Ecco]

Unfortunately this is not specific to a given action / repository.

Anyone hit by this, please read this long comment I wrote and feel free to upvote it.

[barbaracabral]

I had the same issue executing the Zap Action code scan with docker config: https://github.com/zaproxy/action-api-scan

[HakunMatat4]

I have crossed this problem and the solution was nothing but ironic.
After searching for the error message, I crossed this code block that somehow made into the action I was working on but I never noticed it until now.

I tried setting extra permissions but in my case the action doesn't need it at all. I believe the id-token was messing everything and in my case, I removed that whole permissions block which no other action uses it and voila.
The workflow is processing 100% now.

permissions:
  id-token: write
  contents: read
  issues: write
  pull-requests: write

Sources:

1. The hero: https://sjramblings.io/github-actions-resource-not-accessible-by-integration
2. Oficial documentation: https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github\_token